groove-dev 0.27.180 → 0.27.182

package/CLAUDE.md

@@ -295,3 +295,10 @@ Audit-driven release. Multi-agent orchestration system with 7 coordination layer
 - Dashboard: routing donut, cache panel, context health gauges
 - Monitor/QC agent mode (stay active, loop)
 - Distribution: demo video, HN launch, Twitter content
+
+<!-- GROOVE:START -->
+## GROOVE Orchestration (auto-injected)
+Active agents: 0
+See AGENTS_REGISTRY.md for full agent state.
+**Memory policy:** GROOVE manages project memory automatically. Do not read or write MEMORY.md or .groove/memory/ files directly.
+<!-- GROOVE:END -->

package/node_modules/@groove-dev/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/cli",
-  "version": "0.27.180",
+  "version": "0.27.182",
   "description": "GROOVE CLI — manage AI coding agents from your terminal",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groove-dev/daemon",
-  "version": "0.27.180",
+  "version": "0.27.182",
   "description": "GROOVE daemon — agent orchestration engine",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/node_modules/@groove-dev/daemon/scripts/repair-tokens.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+// FSL-1.1-Apache-2.0 — see LICENSE
+//
+// One-off ledger repair for ~/.groove/tokens.json (2026-07 efficiency audit).
+//
+// Entry c3789b6f recorded $20,536.57 from a duplicate-ingestion loop (4,631
+// session records in 380s, payloads duplicated up to 10×). The ingestion bug
+// is fixed in claude-code.js, but the poisoned data still dominates every cost
+// dashboard: recorded all-time spend ~$24K vs ~$3.5K real. This script:
+//   1. Sets the poisoned entry's totalCostUsd to its audited real value (~$325)
+//   2. Truncates every entry's sessions array to the last 500 records
+//      (matches SESSION_CAP in tokentracker.js; aggregates are untouched)
+//   3. Writes a timestamped .bak of the original file first
+//
+// MUST run with the daemon STOPPED — the daemon holds the ledger in memory and
+// rewrites the file, so a live edit gets clobbered. The script checks and aborts.
+//
+// Usage: node repair-tokens.mjs [path-to-tokens.json] [--entry c3789b6f] [--cost 325]
+
+import { readFileSync, writeFileSync, copyFileSync, existsSync } from 'fs';
+import { resolve } from 'path';
+import { homedir } from 'os';
+
+const args = process.argv.slice(2);
+const flag = (name, dflt) => {
+  const i = args.indexOf(`--${name}`);
+  return i !== -1 && args[i + 1] ? args[i + 1] : dflt;
+};
+const tokensPath = args[0] && !args[0].startsWith('--')
+  ? resolve(args[0])
+  : resolve(homedir(), '.groove', 'tokens.json');
+const entryId = flag('entry', 'c3789b6f');
+const correctedCost = Number(flag('cost', '325'));
+const SESSION_CAP = 500;
+
+// Refuse to edit under a live daemon
+try {
+  const res = await fetch('http://127.0.0.1:31415/api/health', { signal: AbortSignal.timeout(1500) });
+  if (res.ok) {
+    console.error('ABORT: GROOVE daemon is running on :31415. Stop it first (groove stop) — it rewrites tokens.json and will clobber this repair.');
+    process.exit(1);
+  }
+} catch { /* no daemon — safe to proceed */ }
+
+if (!existsSync(tokensPath)) {
+  console.error(`ABORT: ${tokensPath} not found. Pass the path explicitly: node repair-tokens.mjs /path/to/tokens.json`);
+  process.exit(1);
+}
+
+const backupPath = `${tokensPath}.${new Date().toISOString().replace(/[:.]/g, '-')}.bak`;
+copyFileSync(tokensPath, backupPath);
+console.log(`Backup written: ${backupPath}`);
+
+const data = JSON.parse(readFileSync(tokensPath, 'utf8'));
+const usage = data.usage || data;
+
+const target = usage[entryId];
+if (target) {
+  const before = target.totalCostUsd;
+  target.totalCostUsd = correctedCost;
+  target.note = `totalCostUsd corrected ${before} -> ${correctedCost} on ${new Date().toISOString().slice(0, 10)} (duplicate-ingestion inflation, see 2026-07 efficiency audit)`;
+  console.log(`Entry ${entryId}: totalCostUsd ${before} -> ${correctedCost}`);
+} else {
+  console.warn(`Entry ${entryId} not found — skipping cost correction.`);
+}
+
+let trimmed = 0;
+for (const entry of Object.values(usage)) {
+  if (Array.isArray(entry?.sessions) && entry.sessions.length > SESSION_CAP) {
+    trimmed += entry.sessions.length - SESSION_CAP;
+    entry.sessions.splice(0, entry.sessions.length - SESSION_CAP);
+  }
+}
+console.log(`Trimmed ${trimmed} session records across all entries (cap ${SESSION_CAP}).`);
+
+writeFileSync(tokensPath, JSON.stringify(data, null, 2));
+const sizeMb = (Buffer.byteLength(JSON.stringify(data)) / 1024 / 1024).toFixed(1);
+console.log(`Repaired ledger written: ${tokensPath} (${sizeMb}MB)`);

package/node_modules/@groove-dev/daemon/src/api.js

@@ -1438,7 +1438,7 @@ Keep responses concise. Help them think, don't lecture them about the system the
       'port', 'journalistInterval', 'rotationThreshold', 'autoRotation',
       'qcThreshold', 'maxAgents', 'defaultProvider', 'defaultWorkingDir',
       'onboardingDismissed', 'defaultModel', 'defaultChatProvider', 'defaultChatModel',
-      'dataSharingDismissed',
+      'dataSharingDismissed', 'replayCeiling', 'velocityCeiling', 'journalistModelTier',
     ];
     for (const key of Object.keys(req.body)) {
       if (!ALLOWED_KEYS.includes(key)) {

package/node_modules/@groove-dev/daemon/src/index.js

@@ -836,6 +836,7 @@ export class Daemon {
     // Persist state before shutdown
     this.state.set('agents', this.registry.getAll());
     await this.state.save();
+    try { this.tokens.flush(); } catch { /* best-effort */ }
 
     // Stop background services
     await this.gateways.stop();

package/node_modules/@groove-dev/daemon/src/journalist.js

@@ -5,6 +5,7 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from 'fs
 import { resolve } from 'path';
 import { execFile, spawn as cpSpawn } from 'child_process';
 import { getProvider, getInstalledProviders, resolveProviderCommand } from './providers/index.js';
+import { agentLogPath } from './process.js';
 
 const DEFAULT_INTERVAL = 300_000; // 5 minutes (safety-net fallback; event-driven triggers handle the normal case)
 const MAX_LOG_CHARS = 100_000; // ~25k tokens budget for synthesis input (captures 80-90% of recent activity)
@@ -168,7 +169,7 @@ export class Journalist {
 
   hasNewActivity(agents) {
     for (const agent of agents) {
-      const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+      const logPath = agentLogPath(this.daemon.grooveDir, agent);
       if (!existsSync(logPath)) continue;
       try {
         const size = statSync(logPath).size;
@@ -182,7 +183,7 @@ export class Journalist {
     const result = {};
 
     for (const agent of agents) {
-      const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+      const logPath = agentLogPath(this.daemon.grooveDir, agent);
       if (!existsSync(logPath)) {
         result[agent.id] = { agent, entries: [], explorationEntries: [] };
         continue;
@@ -574,9 +575,15 @@ export class Journalist {
       const provider = getProvider(providerId);
       if (!provider) continue;
 
-      const selectedModel = provider.constructor.models?.find((m) => m.tier === 'medium')
-        || provider.constructor.models?.find((m) => m.tier === 'light')
-        || provider.constructor.models?.[0];
+      // Digests are light-tier work (Haiku-shaped): default internal overhead to
+      // the cheapest tier, escalate via config only on evidence of quality issues.
+      // On Claude, medium→light cuts the journalist's marginal cost ~90%.
+      const models = provider.constructor.models || [];
+      const preferredTier = this.daemon.config?.journalistModelTier || 'light';
+      const selectedModel = models.find((m) => m.tier === preferredTier)
+        || models.find((m) => m.tier === 'light')
+        || models.find((m) => m.tier === 'medium')
+        || models[0];
       const modelId = selectedModel?.id || null;
 
       // Try CLI headless command first
@@ -1055,7 +1062,7 @@ export class Journalist {
    * Budget: keeps recent turns verbatim, summarizes oldest if over maxChars.
    */
   extractConversationThread(agent, { maxChars = 60000 } = {}) {
-    const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     if (!existsSync(logPath)) return null;
 
     let content;
@@ -1297,7 +1304,7 @@ export class Journalist {
    * Used by the Introducer to tell new agents what their teammates built.
    */
   getAgentFiles(agent) {
-    const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     if (!existsSync(logPath)) return [];
 
     try {
@@ -1335,7 +1342,7 @@ export class Journalist {
    * Used to capture planner conclusions, build summaries, etc.
    */
   getAgentResult(agent) {
-    const logPath = resolve(this.daemon.grooveDir, 'logs', `${agent.id}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     if (!existsSync(logPath)) return '';
 
     try {

package/node_modules/@groove-dev/daemon/src/process.js

@@ -324,6 +324,15 @@ function sanitizeFilename(name) {
   return String(name).replace(/[^a-zA-Z0-9_-]/g, '_').slice(0, 64);
 }
 
+// Agent log files are keyed by sanitized agent NAME, not id — a rotated agent
+// keeps its name and appends to the same file, preserving conversation history
+// across rotations. Every reader must resolve paths through this helper: an
+// id-based path silently misses the file and downstream consumers (handoff
+// briefs, conversation resume, synthesis) fall back to empty context.
+export function agentLogPath(grooveDir, agent) {
+  return resolve(grooveDir, 'logs', `${sanitizeFilename(agent.name)}.log`);
+}
+
 // Apply Claude Code billing mode to a spawn env, in place.
 // The `claude` CLI bills to usage credits when ANTHROPIC_API_KEY is present and
 // to the OAuth subscription otherwise. 'subscription' (default) strips any
@@ -363,6 +372,14 @@ export class ProcessManager {
     this._stalledAgents = new Set(); // agentIds already flagged as stalled (avoids duplicate broadcasts)
     this._exitHandled = new Set();
     this._resultReceived = new Set();
+    // In-flight user messages, kept until a turn actually completes so a
+    // dropped turn can be re-issued instead of losing the user's message.
+    // agentId -> { message, attempts }
+    this._pendingUserMessage = new Map();
+    // Retry count carried across the agent-id change that resume() performs.
+    // Kept separate so teardown of the old agent can't reset it to 0 and
+    // turn a bounded retry into an infinite respawn loop. oldAgentId -> attempts
+    this._retryAttemptCarry = new Map();
     this._truncationFlagged = new Set(); // agentIds that have had any truncation in their session
     this._lastAssistantBlocks = new Map(); // agentId -> last assistant content blocks (for abandoned tool_use detection)
     this._previousCacheReadTokens = new Map(); // agentId -> previous turn's cacheReadTokens
@@ -1138,7 +1155,7 @@ For normal file edits within your scope, proceed without review.
     // Set up log capture (shared between CLI and agent loop paths)
     const logDir = resolve(this.daemon.grooveDir, 'logs');
     mkdirSync(logDir, { recursive: true });
-    const logPath = resolve(logDir, `${sanitizeFilename(agent.name)}.log`);
+    const logPath = agentLogPath(this.daemon.grooveDir, agent);
     const logStream = createWriteStream(logPath, { flags: 'a', mode: 0o600 });
 
     // Inject API key from credential store for agent-loop providers
@@ -1559,26 +1576,54 @@ For normal file edits within your scope, proceed without review.
 
     // Session result data (cost, duration, turns)
     if (output.type === 'result') {
-      tokens.recordResult(agentId, {
-        costUsd: output.cost, durationMs: output.duration, turns: output.turns,
-      });
-      if (output.cost) updates.costUsd = (agent.costUsd || 0) + output.cost;
-      if (output.duration) updates.durationMs = output.duration;
-      if (output.turns) updates.turns = output.turns;
-
-      // Claude Code sometimes hangs after emitting the result event — the
-      // process stays alive instead of exiting.  Record that the result
-      // arrived so exit handlers know this was a successful completion even
-      // if we have to SIGTERM the process.  After a 5s grace period, force-
-      // kill any process that hasn't exited on its own.
-      this._resultReceived.add(agentId);
-      const handle = this.handles.get(agentId);
-      if (handle?.proc && typeof handle.proc.kill === 'function') {
-        setTimeout(() => {
-          if (this.handles.has(agentId) && this._resultReceived.has(agentId)) {
-            try { handle.proc.kill('SIGTERM'); } catch {}
-          }
-        }, 5_000);
+      // Did this result represent a turn that actually ran? CLI >= 2.1.212
+      // emits a 0-turn no-op `result` during --resume reconciliation, before
+      // the real turn starts. Both it and an aborted turn report
+      // duration_api_ms === 0 — the model was never called. Providers that
+      // don't report an API duration (codex, gemini, ollama) are unaffected.
+      const reachedModel = output.apiDurationMs === undefined || output.apiDurationMs > 0;
+
+      // Turn aborted before the model was called — re-deliver the message.
+      // Deliberately does NOT return: session id persistence and the GUI
+      // broadcast below still need to run, and the retry is scheduled async.
+      if (!reachedModel && output.isError) {
+        this._retryDroppedTurn(agentId, agent, output);
+      }
+
+      // Everything below is completion bookkeeping and must only run for a
+      // turn that actually executed. Running it for the resume handshake is
+      // what killed the process mid-turn.
+      if (reachedModel) {
+        // The user's message is safely delivered.
+        this._pendingUserMessage.delete(agentId);
+
+        tokens.recordResult(agentId, {
+          costUsd: output.cost, durationMs: output.duration, turns: output.turns,
+        });
+        if (output.cost) updates.costUsd = (agent.costUsd || 0) + output.cost;
+        if (output.duration) updates.durationMs = output.duration;
+        if (output.turns) updates.turns = output.turns;
+
+        // Claude Code sometimes hangs after emitting the result event — the
+        // process stays alive instead of exiting.  Record that the result
+        // arrived so exit handlers know this was a successful completion even
+        // if we have to SIGTERM the process.  After a 5s grace period, force-
+        // kill any process that hasn't exited on its own.
+        //
+        // MUST stay behind the reachedModel guard. CLI >= 2.1.212 emits a
+        // 0-turn no-op result ~180ms into --resume; arming this on that result
+        // SIGTERMs the process ~5.2s later, mid-turn, before a token is
+        // produced (fable TTFT observed at 34s). The CLI records the signal as
+        // "[Request interrupted by user]" and the user's message is destroyed.
+        this._resultReceived.add(agentId);
+        const handle = this.handles.get(agentId);
+        if (handle?.proc && typeof handle.proc.kill === 'function') {
+          setTimeout(() => {
+            if (this.handles.has(agentId) && this._resultReceived.has(agentId)) {
+              try { handle.proc.kill('SIGTERM'); } catch {}
+            }
+          }, 5_000);
+        }
       }
     }
 
@@ -2510,6 +2555,59 @@ After fixing all issues, run tests (npm test) and build (npm run build) to verif
    * spawns fresh with the full conversation thread instead of --resume.
    * This avoids degraded context from internal compaction.
    */
+  /**
+   * Re-issue a user message whose turn was aborted before reaching the model.
+   *
+   * Returns true if a retry was scheduled (caller should skip normal result
+   * handling), false if the turn should be treated as a real result.
+   */
+  _retryDroppedTurn(agentId, agent, output) {
+    const pending = this._pendingUserMessage.get(agentId);
+    if (!pending) return false; // nothing to re-issue — let it fall through
+
+    const MAX_RETRIES = 2;
+    if (pending.attempts >= MAX_RETRIES) {
+      this._pendingUserMessage.delete(agentId);
+      this.daemon.broadcast({
+        type: 'agent:output',
+        agentId,
+        data: {
+          type: 'activity',
+          subtype: 'error',
+          data: `Message could not be delivered after ${MAX_RETRIES + 1} attempts `
+            + `(${output.terminalReason || output.subtype || 'turn aborted'}). Please re-send.`,
+        },
+      });
+      return false;
+    }
+
+    pending.attempts += 1;
+    this._retryAttemptCarry.set(agentId, pending.attempts);
+    this.daemon.broadcast({
+      type: 'agent:output',
+      agentId,
+      data: {
+        type: 'activity',
+        subtype: 'info',
+        data: `Turn aborted before reaching the model — retrying (${pending.attempts}/${MAX_RETRIES})…`,
+      },
+    });
+
+    // Let the aborted process finish tearing down before re-spawning; resume()
+    // kills the current handle and re-registers under a new agent id.
+    setTimeout(() => {
+      this.resume(agentId, pending.message).catch((err) => {
+        this.daemon.broadcast({
+          type: 'agent:output',
+          agentId,
+          data: { type: 'activity', subtype: 'error', data: `Retry failed: ${err.message}` },
+        });
+      });
+    }, 500);
+
+    return true;
+  }
+
   async resume(agentId, message) {
     const { registry, locks } = this.daemon;
     const agent = registry.get(agentId);
@@ -2577,8 +2675,19 @@ After fixing all issues, run tests (npm test) and build (npm run build) to verif
       workingDir: config.workingDir || this.daemon.config?.defaultWorkingDir || undefined,
       name: config.name,
       teamId: config.teamId,
+      authMode: config.authMode,
     });
 
+    // Hold the message until a turn actually completes, so a turn aborted
+    // before reaching the model can be re-issued rather than lost. Carries the
+    // attempt count forward from the agent id we're replacing.
+    if (message) {
+      const carried = this._retryAttemptCarry.get(agentId);
+      this._retryAttemptCarry.delete(agentId);
+      this._pendingUserMessage.delete(agentId);
+      this._pendingUserMessage.set(newAgent.id, { message, attempts: carried || 0 });
+    }
+
     // Carry cumulative tokens
     if (config.tokensUsed > 0) {
       registry.update(newAgent.id, { tokensUsed: config.tokensUsed });
@@ -2959,6 +3068,10 @@ After fixing all issues, run tests (npm test) and build (npm run build) to verif
     if (throttle?.timer) clearTimeout(throttle.timer);
     this._streamThrottle.delete(agentId);
     this.pendingMessages.delete(agentId);
+    // Safe during a retry: resume() re-registers the message under the new
+    // agent id from its own `message` argument, and the attempt count lives in
+    // _retryAttemptCarry (which kill() must not touch).
+    this._pendingUserMessage.delete(agentId);
 
     // Unregister ambassador if this agent was one
     const agent = this.daemon.registry.get(agentId);

package/node_modules/@groove-dev/daemon/src/providers/claude-code.js

@@ -257,6 +257,13 @@ export class ClaudeCodeProvider extends Provider {
             cost: data.total_cost_usd,
             duration: data.duration_ms,
             turns: data.num_turns,
+            // Error/abort signals. Without these an `error_during_execution`
+            // result looks identical to a successful one and the user's
+            // message is silently dropped.
+            subtype: data.subtype,
+            isError: data.is_error === true || data.subtype === 'error_during_execution',
+            apiDurationMs: data.duration_api_ms,
+            terminalReason: data.terminal_reason,
           });
         }
       } catch {
@@ -268,7 +275,15 @@ export class ClaudeCodeProvider extends Provider {
 
     // Merge events: prefer content-bearing events (activity/result) over usage/session.
     // Accumulate token counts across all events in this chunk.
-    let content = events.find((e) => e.type === 'result') || events.find((e) => e.type === 'activity') || events[events.length - 1];
+    // Prefer an error result over a success one when a single chunk carries
+    // both. During --resume the CLI emits a 0-turn no-op success result
+    // immediately before the real turn's result; taking the first would hide a
+    // subsequent abort and the failure would look like a clean completion.
+    const resultEvents = events.filter((e) => e.type === 'result');
+    let content = resultEvents.find((e) => e.isError)
+      || resultEvents[0]
+      || events.find((e) => e.type === 'activity')
+      || events[events.length - 1];
     const merged = { ...content };
 
     let totalTokens = 0;

package/node_modules/@groove-dev/daemon/src/rotator.js

@@ -18,6 +18,9 @@ const SCORE_HISTORY_MAX = 40;   // ~10 min at 15s intervals
 const COOLDOWN_MS = 5 * 60 * 1000;   // 5 minutes between rotations per agent
 const QUALITY_COOLDOWN_MS = 2 * 60 * 1000; // 2 minutes for quality degradation rotations
 const TOKEN_CEILING = 5_000_000;     // 5M tokens per agent (non-self-managing only)
+const REPLAY_CEILING = 0.50;         // Self-managing providers: rotate idle agents above this context usage
+const VELOCITY_CEILING = 250_000;    // New (non-cache) tokens per window before force rotation
+const VELOCITY_WINDOW_MS = 5 * 60_000;
 const ROLE_MULTIPLIERS = {
   planner: 2,
   fullstack: 4,
@@ -201,13 +204,34 @@ export class Rotator extends EventEmitter {
       const singleTask = providerInstance?.constructor?.singleTask ?? false;
       if (singleTask) continue;
 
-      // Skip agents idle for over 60s — no point scoring them every 15s
-      const idleMs = this._idleMs(agent);
-      if (idleMs > 60_000 && agent.contextUsage < HARD_CEILING) continue;
-
       // Determine if provider manages its own context (e.g. Claude Code compacts internally)
       const selfManagesContext = providerInstance?.constructor?.managesOwnContext ?? false;
 
+      // Velocity safety — new-token burn rate, all provider types. tokensUsed
+      // excludes cache reads, so this measures real generation. Caps worst-case
+      // runaway burn; bypasses cooldown (a runaway must be stopped, not waited out).
+      const velCeiling = this.daemon.config?.velocityCeiling ?? VELOCITY_CEILING;
+      const velocity = this.daemon.tokens?.getVelocity?.(agent.id, VELOCITY_WINDOW_MS) ?? 0;
+      if (velCeiling > 0 && velocity >= velCeiling) {
+        console.warn(`  Rotator: ${agent.name} burned ${velCeiling.toLocaleString()}+ new tokens in 5min — FORCE rotating (velocity)`);
+        await this.rotate(agent.id, { reason: 'velocity_ceiling' });
+        continue;
+      }
+
+      // Replay ceiling — self-managing providers only. Internal compaction keeps
+      // sessions functional but lets context ride at 60-85% indefinitely, and every
+      // subsequent message replays that much context on EVERY API call in the agent
+      // loop. A handoff-brief rotation costs ~10K tokens once; riding high costs
+      // 150-300K per call. Computed here because the idle-skip guard below must
+      // not hide the exact agents this targets (idle, high-context).
+      const replayCeiling = this.daemon.config?.replayCeiling ?? REPLAY_CEILING;
+      const overReplayCeiling = selfManagesContext && replayCeiling > 0
+        && agent.contextUsage >= replayCeiling;
+
+      // Skip agents idle for over 60s — no point scoring them every 15s
+      const idleMs = this._idleMs(agent);
+      if (idleMs > 60_000 && agent.contextUsage < HARD_CEILING && !overReplayCeiling) continue;
+
       if (!selfManagesContext) {
         // Non-Claude: threshold + ceiling + quality rotation
         // These providers fill up linearly and degrade without external rotation
@@ -260,6 +284,13 @@ export class Rotator extends EventEmitter {
             continue;
           }
         }
+      } else if (overReplayCeiling && !this._isOnCooldown(agent.id) && idleMs > 10_000) {
+        // Rotate while idle only — never mid-task — and respect the cooldown.
+        // Continuity comes from the conversation-thread resume; rotate() blocks
+        // the rotation entirely if the thread can't be extracted for a chat agent.
+        console.log(`  Rotator: ${agent.name} at ${Math.round(agent.contextUsage * 100)}% — rotating (replay ceiling)`);
+        await this.rotate(agent.id, { reason: 'replay_ceiling' });
+        continue;
       }
 
       // --- Change 4: Truncation-triggered rotation ---
@@ -409,6 +440,7 @@ export class Rotator extends EventEmitter {
       // empty or the thread is too short to be useful.
       let brief;
       let usedConversationThread = false;
+      const isAutoRotation = options.reason && options.reason !== 'manual';
       if (typeof journalist.buildConversationResumePrompt === 'function') {
         const conversationPrompt = journalist.buildConversationResumePrompt(
           agent,
@@ -421,6 +453,22 @@ export class Rotator extends EventEmitter {
         }
       }
       if (!usedConversationThread) {
+        // Chat-continuity protection: an agent with a live user conversation must
+        // carry that dialogue into the fresh session. If the thread can't be
+        // extracted, a boilerplate brief would wipe the agent's memory of the
+        // conversation — skip the auto-rotation instead (context stays intact,
+        // worst case is status quo). Manual rotations proceed; the user accepts the risk.
+        if (isAutoRotation && this.userMessageTimes.has(agentId)) {
+          console.warn(`  Rotator: ${agent.name} has chat history but no extractable conversation thread — skipping rotation`);
+          this.rotating.delete(agentId);
+          this.daemon.broadcast({
+            type: 'rotation:blocked',
+            agentId,
+            agentName: agent.name,
+            reason: 'no_conversation_thread',
+          });
+          return null;
+        }
         brief = await journalist.generateHandoffBrief(agent, {
           reason: options.reason,
           qualityScore: options.qualityScore,
@@ -435,11 +483,14 @@ export class Rotator extends EventEmitter {
       // with too little meaningful content, the new agent will arrive blind.
       // Block it rather than spawning an agent that can't continue the work.
       // Manual rotations (user-requested) are never blocked — the user accepts the risk.
-      const isAutoRotation = options.reason && options.reason !== 'manual';
       if (isAutoRotation && !usedConversationThread) {
         const briefContent = brief
           .replace(/^#.*$/gm, '')           // strip markdown headers
           .replace(/^[-*].*role:.*$/gim, '') // strip metadata lines
+          // Strip the static Instructions boilerplate generateHandoffBrief always
+          // appends (~400 chars) — padding must not defeat the content threshold
+          .replace(/^- (Do NOT|If the task).*$/gm, '')
+          .replace(/^Continue and finish the in-progress task.*$/gm, '')
           .replace(/^\s*$/gm, '')           // strip blank lines
           .trim();
         if (briefContent.length < 200) {
@@ -716,6 +767,8 @@ export class Rotator extends EventEmitter {
     const hardCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'hard_ceiling').length;
     const tokenCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'token_ceiling').length;
     const estimatedCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'estimated_context_ceiling').length;
+    const replayCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'replay_ceiling').length;
+    const velocityCeilingRotations = this.rotationHistory.filter((r) => r.reason === 'velocity_ceiling').length;
     return {
       enabled: this.enabled,
       totalRotations,
@@ -726,6 +779,8 @@ export class Rotator extends EventEmitter {
       hardCeilingRotations,
       tokenCeilingRotations,
       estimatedCeilingRotations,
+      replayCeilingRotations,
+      velocityCeilingRotations,
       rotating: Array.from(this.rotating),
       liveScores: this.liveScores,
       scoreHistory: this.scoreHistory,
@@ -734,6 +789,8 @@ export class Rotator extends EventEmitter {
       qualityThreshold: QUALITY_THRESHOLD,
       cooldownMs: COOLDOWN_MS,
       tokenCeiling: TOKEN_CEILING,
+      replayCeiling: this.daemon.config?.replayCeiling ?? REPLAY_CEILING,
+      velocityCeiling: this.daemon.config?.velocityCeiling ?? VELOCITY_CEILING,
       roleMultipliers: ROLE_MULTIPLIERS,
     };
   }